Reject reserved locale and domain keys to prevent prototype pollution

[cpruijsen]

Summary

addTranslations, setLocale, and setTextDomain now reject non-strings and keys that live on Object.prototype (key in {}).

Fixes GHSA-g974-hxvm-x689 / CVE-2024-21528: addTranslations('__proto__', 'polluted', 'pwned') wrote onto Object.prototype because catalogs['__proto__'] is the prototype object. Reproduced on this tree at 3.0.1 (the advisory's "last affected" 3.0.0 is stale; 3.0.1 was docs/deps only). Issue #72 asked to backport postalsys/gettext@63e627c.

Tests cover the Snyk PoC, a reserved domain key, the reserved-key error event, and the two setters.

Decision

Reserved-key rejection via key in {} plus type checks, as in the cited backport. Alternative: Object.create(null) for catalogs and per-locale maps, so __proto__ would be an ordinary own property instead of the prototype setter. #72 asked for the reserved-key rejection, and this file already validates locale/domain types the same way. Can switch to null-prototype catalogs.

The cited commit type-checked locale twice (the second warning still said setLocale()). This PR type-checks domain instead, matching setTextDomain here and postalsys/gettext@c2bf8dc.

Fixes #72

Test plan

• addTranslations('__proto__', 'polluted', 'pwned') does not set {}.polluted
• addTranslations('et-EE', '__proto__', translations) does not create/rewrite that catalog
• setLocale('__proto__') / setTextDomain('__proto__') leave the previous locale/domain
• npx mocha test/gettext-test.js (42 passing) and npx grunt (jshint + mocha)